Skip to content
OpenAdvisories

Package · Wolfi

trino-plugin-ranger

89 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-106449

    yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

    yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty bl…

    yawkat lz4-java druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Low 3.7
    CVE-2025-11143

    org.eclipse.jetty:jetty-http has different parsing of invalid URIs

    The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list…

    Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven
  • Low 2.9
    CVE-2025-58056

    Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

    Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline ch…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Low 3.3
    CVE-2025-27496

    Snowflake JDBC Driver client-side encryption key in DEBUG logs

    Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versions 3.0.13 through 3.23.0 of the driver. When the logging level was set to DEBUG, the Driver would l…

    snowflakedb snowflake-jdbc trino trino-plugin-opensearch Wolfi Maven
  • Low 2.4
    CVE-2024-12801

    SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks

    Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modific…

    QOS.CH Sarl logback thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • Low 3.7
    CVE-2024-6763

    Jetty URI parsing of invalid authority

    Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of H…

    Eclipse Foundation Jetty druid trino Debian Ubuntu Wolfi Maven